From mboxrd@z Thu Jan 1 00:00:00 1970 Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755661AbeAHGmN (ORCPT + 1 other); Mon, 8 Jan 2018 01:42:13 -0500 Received: from wtarreau.pck.nerim.net ([62.212.114.60]:38821 "EHLO 1wt.eu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755494AbeAHGmM (ORCPT ); Mon, 8 Jan 2018 01:42:12 -0500 Date: Mon, 8 Jan 2018 07:42:00 +0100 From: Willy Tarreau To: Eric Biggers Cc: linux-fsdevel@vger.kernel.org, Alexander Viro , Joe Lawrence , Michael Kerrisk , Mikulas Patocka , "Luis R . Rodriguez" , Kees Cook , linux-kernel@vger.kernel.org, Eric Biggers Subject: Re: [PATCH 4/7] pipe: fix off-by-one error when checking buffer limits Message-ID: <20180108064200.GB10411@1wt.eu> References: <20180108053542.6472-1-ebiggers3@gmail.com> <20180108053542.6472-5-ebiggers3@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20180108053542.6472-5-ebiggers3@gmail.com> User-Agent: Mutt/1.6.1 (2016-04-27) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: On Sun, Jan 07, 2018 at 09:35:39PM -0800, Eric Biggers wrote: > From: Eric Biggers > > With pipe-user-pages-hard set to 'N', users were actually only allowed > up to 'N - 1' buffers; and likewise for pipe-user-pages-soft. > > Fix this to allow up to 'N' buffers, as would be expected. Interesting. I was a bit surprized at first and found that this was changed by b0b91d1 ("pipe: fix limit checking in pipe_set_size()"). Prior to this fix, only already allocated pipes were counted. After the fix, an allocation attempt was made before checking the size. So I think that your fix is needed in stable versions which backported the commit above. > Signed-off-by: Eric Biggers Acked-by: Willy Tarreau Thanks, Willy